Extracted

• • Target

    JaffaCakes118_834b58415f6375bc117e75b8442da88e

  • Size

    645KB

  • MD5

    834b58415f6375bc117e75b8442da88e

  • SHA1

    c7ea60d0ce5f9db6cbb972d4bccf2399f81d3783

  • SHA256

    9ec4ac892201a8bdda045f90ed16fd2b1de10c3a90f41947e779a73f34d5fb44

  • SHA512

    bc6a3cdfd2db7b06f21990dabeffda52c5976393624e74fd1c01bf81547840c71ea3251e64dddbd3aacd71c12ec62e66bd40f2c3139088b4dbe0ceb9f261cc1e

  • SSDEEP

    6144:GKIM30YQqLwhHrWY/yjLRTT7ZEq/GZrztYv4L2uAo3uNDd5Zuc3YoignqAoH85u:GhYQqLWfitTT9Eq/KHq743uvuOqAoH88

  Score

  10^/10

  cybergatelevel-23hackindiscoverypersistencestealertrojanupx

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate

  • Cybergate family

    cybergate

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2